Buggy code:
public class WebRequestCycle extends RequestCycle { private static final Logger log = LoggerFactory . getLogger ( WebRequestCycle . class ) ; private static final MetaDataKey BROWSER_WAS_POLLED_KEY = new MetaDataKey ( Boolean . class ) { private static final long serialVersionUID = 1L ; } ; public WebRequestCycle ( final WebApplication application , final WebRequest request , final Response response ) { } public IRequestCycleProcessor getProcessor ( ) { } public WebRequest getWebRequest ( ) { } public WebResponse getWebResponse ( ) { } public WebSession getWebSession ( ) { } public final void redirectTo ( final Page page ) { String redirectUrl = null ; IRequestCycleSettings settings = application . getRequestCycleSettings ( ) ; <START_BUG> if ( ( ( settings . getRenderStrategy ( ) ) == ( IRequestCycleSettings . REDIRECT_TO_BUFFER ) ) && ( ( application ) instanceof WebApplication ) ) { <END_BUG> final WebResponse currentResponse = getWebResponse ( ) ; try { if ( ( getWebRequest ( ) ) instanceof ServletWebRequest ) { ( ( ServletWebRequest ) ( getWebRequest ( ) ) ) . setWicketRedirectUrl ( Strings . replaceAll ( page . urlFor ( INTERFACE ) . toString ( ) , "..//" , "" ) . toString ( ) ) ; } final BufferedHttpServletResponse servletResponse = new BufferedHttpServletResponse ( currentResponse . getHttpServletResponse ( ) ) ; final WebResponse redirectResponse = new WebResponse ( servletResponse ) { public CharSequence encodeURL ( CharSequence url ) { return currentResponse . encodeURL ( url ) ; } } ; redirectResponse . setCharacterEncoding ( currentResponse . getCharacterEncoding ( ) ) ; setResponse ( redirectResponse ) ; page . renderPage ( ) ; setResponse ( currentResponse ) ; final String responseRedirect = servletResponse . getRedirectUrl ( ) ; if ( responseRedirect != null ) { redirectUrl = responseRedirect ; } else if ( ( servletResponse . getContentLength ( ) ) > 0 ) { servletResponse . filter ( currentResponse ) ; servletResponse . setCharacterEncoding ( currentResponse . getCharacterEncoding ( ) ) ; servletResponse . close ( ) ; if ( ( getWebRequest ( ) ) instanceof ServletWebRequest ) { ( ( ServletWebRequest ) ( getWebRequest ( ) ) ) . setWicketRedirectUrl ( null ) ; } redirectUrl = page . urlFor ( INTERFACE ) . toString ( ) ; String stripped = Strings . replaceAll ( redirectUrl , "..//" , "" ) . toString ( ) ; int index = stripped . indexOf ( "?" ) ; String sessionId = getApplication ( ) . getSessionStore ( ) . getSessionId ( request , true ) ; ( ( WebApplication ) ( application ) ) . addBufferedResponse ( sessionId , stripped . substring ( ( index + 1 ) ) , servletResponse ) ; } } catch ( RuntimeException ex ) { setResponse ( currentResponse ) ; if ( ex instanceof AbortException ) { throw ex ; } if ( ex instanceof PageExpiredException ) { logRuntimeException ( ex ) ; } IRequestCycleProcessor processor = getProcessor ( ) ; processor . respond ( ex , this ) ; return ; } } else { redirectUrl = page . urlFor ( INTERFACE ) . toString ( ) ; } if ( redirectUrl == null ) { redirectUrl = page . urlFor ( INTERFACE ) . toString ( ) ; } getSession ( ) . touch ( page ) ; response . redirect ( redirectUrl ) ; } protected ClientInfo newClientInfo ( ) { } public final boolean isRedirect ( ) { } }

Fix:
if ( ( ( ( settings . getRenderStrategy ( ) ) == ( IRequestCycleSettings . REDIRECT_TO_BUFFER ) ) && ( ( application ) instanceof WebApplication ) ) && ( ! ( getWebRequest ( ) . isAjax ( ) ) ) ) {